Loading story…
European law enforcement agencies dismantled the privacy-focused service First VPN, which investigators say was widely used to conceal ransomware attacks, data theft, fraud, and other cybercrime. The operation was led by French and Dutch authorities with Europol support and coordinated action on May 19–20, resulting in the seizure of 33 servers across 27 countries, the takeover of multiple First VPN domains and related onion services, and enforcement activity in Ukraine, where authorities questioned a suspected administrator and searched a residence. Officials said the service was openly advertised on Russian-speaking cybercrime forums and marketed features such as anonymity, hidden infrastructure, anonymous payments, and refusal to cooperate with law enforcement.
Investigators said they had infiltrated First VPN’s infrastructure before the takedown, obtained the service’s user database, and collected traffic data that exposed thousands of users allegedly tied to cybercrime. Europol said the platform had surfaced in nearly every major cybercrime investigation it supported in recent years, and authorities have already shared information on 506 users and 83 intelligence packages to aid ongoing cases worldwide. Officials described the seizure as the removal of a key layer criminals relied on to hide identities, communications, and backend systems, while warning that follow-on investigations into ransomware, fraud, and related offenses are continuing.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Europol said intelligence gathered from the dismantled First VPN service is being used to support 21 additional cybercrime investigations across multiple jurisdictions worldwide. The update showed the takedown had expanded into follow-on cases beyond the initial seizure and user identification efforts.
On 2026-05-21, the FBI released FLASH-20260521-001 detailing indicators of compromise, domains, communication accounts, current and historical IP addresses, and MITRE ATT&CK techniques associated with First VPN Service. The advisory said the service had been used by at least 25 ransomware groups and provided defensive recommendations following the international takedown.
Following the May 2026 takedown, investigators publicly identified 65 IP addresses associated with First VPN. The disclosure added new technical indicators tied to the criminal VPN service for partner agencies and defenders.
Authorities said they infiltrated First VPN's infrastructure, obtained its user database and traffic data, identified users, and shared information on 506 users plus 83 intelligence packages to support ongoing investigations worldwide.
During the May 19–20, 2026 international operation against First VPN, law enforcement arrested the service's administrator. This goes beyond the previously reported questioning of a suspect in Ukraine and marks a concrete enforcement action tied to the takedown.
As part of the May 19–20, 2026 operation, authorities in Ukraine conducted a house search and questioned a suspected administrator linked to First VPN.
During a coordinated action on May 19–20, 2026, law enforcement agencies dismantled First VPN, seized 33 servers across 27 countries, and took control of multiple domains and related onion services tied to the platform.
French and Dutch authorities expanded the case by forming a joint investigation team in November 2023, with Europol later supporting the operation through an operational taskforce.
Authorities began investigating the privacy-focused VPN service First VPN in December 2021 over its suspected use in ransomware, data theft, fraud, and other cybercrime activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
21 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcexakep.ru
Open sourcesecurityonline.info
Open sourceteiss.co.uk
Open sourcehelpnetsecurity.com
Open sourceoperation-saffron.eu
Open sourcetherecord.media
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Treasury sanctioned **First VPN Service** (`1VPNS`), its alleged Ukrainian administrator **Dmytro Rashevskyi**, and Belarusian cryptor seller **Yevgeniy Vladimirovich Silayev** for allegedly supporting ransomware and other cybercriminal activity. Officials said `1VPNS` provided anonymizing infrastructure that helped threat actors hide their identities, disguise malware, and evade detection during attacks on U.S. municipalities, hospitals, schools, businesses, and critical infrastructure providers. Treasury alleged Rashevskyi used false identities to obtain infrastructure for the service, while Silayev sold malware-obfuscation tools that made malicious code harder for defenders to detect. The sanctions, issued under **Executive Order 14390** and **E.O. 13694** as amended, block U.S. persons from transacting with the designated parties and mark a broader move against ransomware enablers rather than only the gangs themselves. The action was coordinated with the United Kingdom and followed a May law enforcement takedown of `1VPNS` infrastructure by European agencies with FBI support. Separate reporting said blockchain tracing tied payments from ransomware groups including **Anubis**, **Qilin**, and **Sinobi Group** to FirstVPN, adding financial evidence that the service was used as operational infrastructure by ransomware actors.
Jul 14, 2026
An international law-enforcement operation dubbed **Operation Lightning** disrupted **SocksEscort**, a paid “residential proxy” service that routed criminal traffic through compromised home/small-business routers and IoT devices to provide anonymity for fraud and other cybercrime. Authorities from the US and multiple European countries (including Austria, France, and the Netherlands), supported by **Europol** and **Eurojust** and assisted by private-sector partners **Lumen’s Black Lotus Labs** and the **Shadowserver Foundation**, reported the botnet had leveraged exploited vulnerabilities in edge devices and was powered by **AVRecon** (Linux) malware. Officials said SocksEscort advertised access to roughly **369,000 IP addresses** since 2020, with Europol stating the infrastructure compromised **369,000+** routers/IoT devices across **163 countries** and offered customers tens of thousands of proxies; reporting also noted that, as of February 2026, the service listed about **8,000 infected routers**, including roughly **2,500 in the United States**. During the coordinated action, authorities **seized 34 domains and 23 servers** across **seven countries**, replaced the service’s website with a seizure notice, and the US froze approximately **$3.5 million in cryptocurrency** tied to the operation; officials also cited the service’s payment platform receiving about **$5.8 million** from customers. SocksEscort was described as enabling a wide range of downstream criminal activity—including large-scale fraud, account takeovers, identity theft, business email compromise, password spraying, and, per Europol, facilitation of **ransomware**, **DDoS**, and distribution of **CSAM**—with US reporting citing specific victim losses (including a **$1M** cryptocurrency theft and additional six-figure fraud impacts). Investigators indicated the seized infrastructure and customer data (reported as roughly **124,000 users**) will be used to pursue follow-on investigations into both operators and customers of the proxy service.
Jun 29, 2026
U.S. and European law enforcement agencies disrupted the **QakBot** botnet, seizing infrastructure tied to malware that had infected more than **700,000 computers** worldwide and enabled ransomware, financial fraud, and other criminal activity. Europol and U.S. authorities said the operation cut off command-and-control systems and removed malware from compromised hosts, while CISA published guidance on the botnet’s tactics, indicators, and the broader effort to identify and disrupt the infrastructure behind it. Officials said QakBot operators and affiliates had generated at least **EUR 54 million** in ransom payments over the years. The takedown also produced a large cache of stolen data that the FBI shared for victim notification, allowing affected individuals to check exposed information through **Have I Been Pwned**. Reporting after the operation said the action could serve as a model for future botnet disruptions, with investigators using legal authorities and international coordination to seize servers, redirect traffic, and weaken criminal ecosystems that support follow-on ransomware attacks.
Jul 12, 2026